Researchers Detailed How an ApeCoin Claim Was Captured With Flash-Borrowed NFTs

Check Point Research disclosed on March 19, 2022 how an Ethereum user had combined an NFTX flash loan with ApeCoin’s newly opened claim contract to collect 60,564 APE associated with six Bored Ape Yacht Club NFTs. Five of the NFTs were controlled only within the transaction; the sixth had been purchased before the operation.

The transaction occurred on March 17, 2022, when ApeCoin claims opened. Its significance became clearer with the March 19 technical account: the claim mechanism checked which wallet controlled an eligible NFT when the contract was called, but did not use an earlier ownership snapshot or require a minimum holding period.

That design let temporary control satisfy the contract’s eligibility test. It also illustrated how separately functioning protocols can produce an outcome their designers or users may not have anticipated when they are composed in one atomic transaction.

What happened on Ethereum

The operator first acquired Bored Ape #1060 and used NFTX infrastructure to obtain 5.2 BAYC vault tokens through a flash loan. Those fungible vault tokens could be redeemed for five Bored Ape NFTs held inside the NFTX vault.

After redeeming the five NFTs, the operator controlled six eligible Bored Apes: the five retrieved from NFTX and the previously purchased NFT. The wallet then called the ApeCoin claim contract and received 60,564 APE—exactly six allocations of 10,094 APE.

Before the same Ethereum transaction ended, the operator returned the NFTs to the NFTX vault, recreated the vault tokens and repaid the flash loan. Ethereum’s atomic execution meant the entire sequence either completed together or reverted. The surviving transaction record therefore shows a successful claim and repayment, not an unpaid loan or permanent taking of the five borrowed NFTs.

The on-chain record directly verifies the 60,564 APE transfer. It does not, by itself, establish the operator’s intent or whether the conduct should be classified legally as theft, exploitation or arbitrage.

A claim-design problem, not a conventional contract drain

Check Point characterized the episode as a vulnerability and flash-loan attack. That terminology was contested in contemporaneous discussion because the operator did not bypass an authorization check or force the contract to execute prohibited code. Instead, the transaction satisfied the ownership condition exactly as the claim contract measured it.

The weakness was temporal. ApeCoin eligibility depended on possession at the instant of claiming, while NFTX made it possible to obtain and return that possession inside one transaction. Because each NFT’s allocation could be claimed only once, the operation captured allocations attached to NFTs that had been sitting in a pooled vault.

This distinction matters. The ApeCoin contract was not reported as losing tokens beyond its programmed distribution, and the borrowed NFTs returned to NFTX. The event exposed an incentive and eligibility mismatch between an airdrop contract and a composable NFT-liquidity protocol.

What the March 19 disclosure established

The strongest conclusion available on March 19, 2022 was that snapshot-free NFT eligibility could be manipulated through atomic borrowing. A claim system based only on current ownership treated long-term possession, a recent purchase and transaction-length control alike.

Contemporaneous sources attached different dollar figures to the operation because some valued the gross APE claim, others measured the token swap, and others attempted to subtract acquisition costs, fees and losses on the purchased NFT. Without a single disclosed accounting convention and execution-time valuation, this reconstruction does not assign a dollar loss or net profit.

The verified record is narrower: one transaction claimed 60,564 APE by temporarily combining five NFTX-held Bored Apes with one purchased Bored Ape. The March 19 analysis turned that transaction into an early case study in how composability can undermine assumptions embedded in token-distribution rules.